Cyber insurance and security questionnaires: how UAE companies should answer them

Why the questions got harder

Ransomware and payment fraud claims pushed insurers to ask for specific controls before quoting, and larger customers did the same with their suppliers. The UAE Cybersecurity Council has also raised the profile of cyber risk at board level. The result is the same questionnaire landing on the CFO's desk from the broker, from a bank, and from a key customer's procurement team, each worded slightly differently.

The good news is that they all ask about the same dozen controls. Build the evidence once and you can answer all of them.

The controls they ask about, and what "yes" should mean

Multi-factor authentication

Typical questions: Is MFA enforced for email? For remote access (VPN, remote desktop)? For all privileged accounts? For cloud admin consoles?

"Yes" should mean enforced by policy for every user rather than merely available. Evidence: Conditional Access or MFA policy screenshots and a sign-in report showing coverage. Our Microsoft 365 security baseline covers the set-up.

Endpoint detection and response (EDR)

Typical questions: Do you run EDR, beyond basic antivirus, on all endpoints and servers? Is it monitored 24/7?

"Yes" should mean every laptop and server, with alerts watched out of hours by you or a provider. Evidence: console export of device coverage and the monitoring contract. See choosing EDR and MDR.

Backups

Typical questions: Are backups offline, immutable or otherwise segregated? Are they encrypted? When did you last test a full restore?

Evidence: backup design, immutability settings, and a dated restore test log. See our disaster recovery planning guide.

Patching and end-of-life systems

Typical questions: How quickly are critical patches applied? Do you run any unsupported operating systems?

Evidence: patch compliance report; a list of any end-of-life systems with isolation measures and a replacement date.

Email security

Typical questions: Do you filter inbound email for malicious links and attachments? Are SPF, DKIM and DMARC in place? Do you verify payment change requests by phone?

Evidence: email security policy screenshots, DMARC record, and the written payment verification procedure. Try our email security checker.

Privileged access

Typical questions: Are admin accounts separate from daily accounts? Is privileged access logged and reviewed?

Vulnerability assessment and penetration testing (VAPT)

Typical questions: When was your last external penetration test? Were critical findings fixed? Do you scan for vulnerabilities regularly?

Evidence: the latest VAPT report summary, a remediation tracker and a retest letter.

Incident response and training

Typical questions: Do you have a written incident response plan? Has it been tested? Do staff receive phishing awareness training?

Evidence: the plan, a dated tabletop exercise record, training completion figures. See phishing awareness training.

How to answer honestly without losing the deal

• Be precise. "MFA is enforced for all 240 users on Microsoft 365 and for VPN; two service accounts are excluded and restricted by IP" is better than a bare "yes".
• Declare partial coverage with a date. "EDR on all laptops; servers by 30/11" is a credible answer.
• Do not copy last year's answers. Things change: a new site, a new remote access tool, an acquisition.
• Get IT and finance in one room. Finance signs; IT knows what is true.
• Ask your broker how misstatements are treated and which controls carry the most weight with that insurer.

Build an evidence pack once

Keep a folder, refreshed every quarter, with:

• MFA policy and coverage report.
• EDR coverage export and monitoring arrangement.
• Backup design, immutability proof and the last three restore tests.
• Patch compliance report and end-of-life register.
• Email security settings and DMARC status.
• Admin account list and the last access review.
• Latest VAPT report summary, fix tracker and retest.
• Incident response plan and last exercise record.
• Training completion summary.
• Network diagram and asset register.

With this pack, most questionnaires take hours rather than weeks, and the answers match each other.

Customer and supplier questionnaires

Banks, multinationals and government-linked customers send their own questionnaires during procurement and at contract renewal. They cover the same controls as insurers, plus a few more:

• Where their data will be stored and who can access it, often with reference to the UAE PDPL or their own sector rules.
• Your subcontractors and IT providers, and how you control their access.
• Certifications you hold, or the frameworks you align to.
• How quickly you will notify them of an incident that affects their data.
• Your business continuity and disaster recovery arrangements.

Keep one master set of approved answers, owned by a named person, and reuse it. Inconsistent answers to the same customer across two years are a red flag for their risk team. If a question asks for a certification you do not hold, say so plainly and describe the controls you do have.

A 90-day plan if you are starting from scratch

1. Days 1–15: collect the questionnaires you have received, list every control asked about, and mark each as yes, partial or no with evidence.
2. Days 15–45: close MFA gaps, deploy EDR to remaining devices, set up an immutable backup copy.
3. Days 45–75: run an external VAPT, fix critical and high findings, write or update the incident response plan.
4. Days 75–90: retest, hold a tabletop exercise, assemble the evidence pack, brief your broker.

Gaps to close first

1. MFA on email, remote access and every admin account.
2. EDR on every endpoint and server, with someone watching alerts.
3. An immutable or offline backup copy, with a recent restore test.
4. Remove or isolate unsupported systems.
5. An external penetration test, with critical findings fixed.

These five come up on almost every form we see.

Where Missan helps

We deliver VAPT in-house, with a report, a prioritised fix list and a retest. We close the gaps (MFA, EDR, backup, patching, email security), run managed detection and response so alerts are watched, and build the evidence pack you hand to your broker or customer. The declaration stays yours to sign. We have worked in UAE IT for 22+ years and hold 4.6★ from 200+ Google reviews. Start with the cybersecurity readiness scorecard or send us the questionnaire.

Related Missan services

• Managed cybersecurity, MDR and VAPT
• Cybersecurity readiness scorecard
• Cybersecurity checklist for UAE leaders
• Missan trust centre

Frequently asked questions

What do cyber insurers in the UAE usually ask about?

The recurring themes are multi-factor authentication (especially for email, remote access and admin accounts), endpoint detection and response, backups that are offline or immutable and tested, patching, email security, privileged access, incident response planning and staff awareness training. The exact wording differs between insurers and brokers.

What happens if we answer "yes" to a control we only partly have?

It can put a claim at risk. If the insurer finds after an incident that a declared control was not in place, it may dispute the claim. Answer accurately, explain partial coverage and give a date for completion. Ask your broker how the specific policy treats misstatements.

Is a vulnerability assessment the same as a penetration test?

No. A vulnerability assessment scans for known weaknesses across many systems. A penetration test is a targeted attempt by a tester to exploit weaknesses and show what an attacker could reach. VAPT combines both. Questionnaires often ask when you last had a penetration test and whether findings were fixed.

How often should we run VAPT?

At least once a year for external-facing systems, and after major changes such as a new website, a new remote access solution or a merger. Regulated sectors and larger customers may ask for more frequent testing.

Can Missan fill in the questionnaire for us?

We help you prepare accurate answers and the evidence behind them, and we can sit in on calls with your broker or customer. The declaration is yours to sign, so you and your insurer stay in control of what is stated.

Does Missan do VAPT itself?

Yes. We deliver vulnerability assessment and penetration testing in-house, with a written report, a prioritised fix list and a retest of fixed items.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 17/10/2026.